CVE-2023-32213

When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'

Impact A "mismatch" type InventoryTransactionPacket is sent by the client to request a resync of all currently open inventories. Since PocketMine-MP does not rate-limit these "mismatch" transactions, and the syncing of inventories is not deferred until, e.g. the end of the current tick, they can ...

GHSA-42QM-8V8M-M78C PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket'

Impact A "mismatch" type InventoryTransactionPacket is sent by the client to request a resync of all currently open inventories. Since PocketMine-MP does not rate-limit these "mismatch" transactions, and the syncing of inventories is not deferred until, e.g. the end of the current tick, they can ...

Debian DSA-5417-1 : openssl - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5417 advisory. - A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy...

PT-2023-3739 · Advantech · Advantech Webaccess

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess version 8.4.5 Description: The issue is related to insufficient authentication data validation in the software. An attacker could exploit this by tricking an authenticated user into loading a maliciously crafted .zip file,...

CLSA-2023-1685377319 vim: Fix of CVE-2023-2610

CVE-2023-2610: limit the text length to MAXCOL...

CVE-2023-24603

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data...

Code injection

OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a crafted iCal feed to provide an unlimited amount of data...

The vulnerability of the RequestInfoByXml function in the software interface of the API platform for collaborative work and automation of documentation processing in Weaver e-cology allows a malicious actor to gain access to read, modify, or delete data.

The vulnerability of the RequestInfoByXml function in the software interface of the API for collaborative work and automation of documentation processing in the Weaver e-cology platform is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could all...

[SECURITY] [DSA 5414-1] docker-registry security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5414-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 27, 2023 https://www.debian.org/security/faq -...

Attacker can force the failure of transactions that use tryCatch

Lines of code Vulnerability details Attacker can force the failure of transactions that use tryCatch An attacker or malicious relayer can force the failure of transactions that rely on tryCatch by carefully choosing the gas limit. Impact The tryCatch function present in the AmbireAccount contract...

CVE-2022-47138

Cross-Site Request Forgery CSRF vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin = 2.1 versions...

CVE-2022-47138

Cross-Site Request Forgery CSRF vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin = 2.1 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin = 2.1 versions...

CVE-2023-2887 User Authentication Bypass in CBOT's Chatbot

Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2022-47138

The CVE CVE-2022-47138 references a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin LOGIN AND REGISTRATION ATTEMPTS LIMIT (German Krutov) for versions ≤ 2.1. Public sources describe: vulnerable condition is CSRF with unauthenticated user privilege required, exploitable ove...

CVE-2022-47138 WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin = 2.1 versions...

PT-2023-15183 · German Krutov · Login/Registration Attempts Limit

Name of the Vulnerable Software and Affected Versions: German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin versions = 2.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.12.3 on Red Hat Enterprise Linux 8 from Red Hat Container Registry. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS bas...

DEBIAN-CVE-2023-28709

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted...